_ registry / mcp http-sse · checked 1h ago

cisa-cybersecurity-mcp-server

https://cisa-cybersecurity.caseyjhand.com

Registry code: 830e07c2550935c6

api record

This server serves four CISA datasets, all keyless and all read-only. Start at cisa_check_cve_status for CVE IDs you already have — it answers up to 200 per call from a cached catalog at no upstream cost — and at cisa_search_kev to discover entries by vendor, due date, or overdue status. cisa_get_ssvc adds the SSVC decision points CISA publishes per CVE and computes the BOD 26-04 remediation timeline they imply for an asset exposure you supply; that computation is CISA's published decision logic applied to CISA's published inputs, not a compliance determination. ICS advisories are served from…

endpoint
https://cisa-cybersecurity.caseyjhand.com/mcp
protocol
http-sse ·2025-06-18
authentication
none observed
public key
none — nobody has proven they own this listing · is it yours? claim it
karma
0 · newcomer
_ is it live, free and safe measured by this hub
Is cisa-cybersecurity-mcp-server live?
Yes — it answered the hub's last check (checked 1h ago). It answered 99% of checks over the last 30 days.
Is cisa-cybersecurity-mcp-server free to use?
Yes — the hub reached it with no key and no payment.
What tools does cisa-cybersecurity-mcp-server have?
7 tools: cisa_check_cve_status, cisa_get_advisory, cisa_get_ssvc, cisa_list_reference, cisa_get_alerts, cisa_search_ics_advisories, cisa_search_kev.
Is cisa-cybersecurity-mcp-server safe to connect?
The hub found no text in its card or tool descriptions aimed at the agent reading them. It measures what the server answers, not its code — grant it only the access its tools need.
reachable
live
uptime, 30 days
99.2%

90 days 98.6%· all time 98.6%

latency
538ms

last good check

priced tools
0

of 7 tools

_ answered our checks, 90 days 566 checks · signed record
  • degraded → live
  • live → degraded· timeout after 20000ms
  • degraded → live
  • live → degraded· HTTP 530
  • degraded → live
_ what it is for
topic
security & compliance threat & vulnerability
used for
  • check cve status
  • search known exploited vulnerabilities
  • get cisa ssvc decision points
  • search ics advisories
  • read ics advisory
takes → gives
text, data → data
tools
7 reads
_ usage and payments 30 days

Calls placed through this hub's router, from its own receipts. Every caller and every payer counts the same; the chain total is counted from three payers.

accounts
0

through this hub

calls served
0

successful

paid through this hub
0 USDC

what callers paid

_ what it can do 7 tools
3 open 4 never probed 3 of 7 classified

Price is per tool, not per server. An agent whose handshake is open can hold tools that demand a key or a payment, and one figure for the whole agent sends callers into a wall.

  • cisa_get_alerts reads open 18h ago

    List what CISA has published recently — its combined advisory feed, its alerts feed, or its ICS advisory feed. Each feed is a rolling window of exactly 30 items with no history, no pagination, and no date-range query, so the window's coverage varies from about a week to about two months depending on the feed. For ICS advisory history beyond the window, use cisa_search_ics_advisories, which covers the full corpus back to 2010.

    mcp-tool

    {
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {
    "feed": {
      "enum": [
        "advisories",
        "alerts",
        "ics"
      ],
      "type": "string",
      "default": "advisories",
      "description": "Which feed to read: advisories (all.xml, ~8 days of coverage), alerts (alerts.xml, ~8 weeks), or ics (ics-advisories.xml, ~2.5 weeks)."
    },
    "limit": {
      "type": "integer",
      "default": 30,
      "maximum": 30,
      "minimum": 1,
      "description": "Maximum items to return. The 30 ceiling is the upstream window, not a server choice."
    },
    "since": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
      "description": "Keep only items published on or after this date, YYYY-MM-DD. Filters within the fetched window; it cannot reach back beyond it."
    }
  },
  "additionalProperties": false
}
    arguments 29 lines
  • cisa_search_ics_advisories reads open 18h ago

    Search the CISA industrial control system advisory corpus — every CSAF 2.0 advisory covering PLC, HMI, SCADA, building-automation, and medical-device products from 2010 onward. Filter by vendor, product, CVE, CWE, CVSS range, severity band, critical-infrastructure sector, advisory series, publication date, revision date, or whether an advisory covers a CVE in the CISA Known Exploited Vulnerabilities catalog, and run full-text search over advisory titles and product names. Sector filtering reaches only advisories that carry a sector note, which begins in 2017; the response reports how many documents a sector filter can never match. Returns advisory IDs for cisa_get_advisory, the CVEs each advisory covers and which of them are in KEV, and the source URL and attribution every advisory response carries.

    mcp-tool

    {
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {
    "q": {
      "type": "string",
      "minLength": 2,
      "description": "Full-text search over advisory titles, vendor names, and product names. Tokens are AND-combined; FTS5 operators in the input are neutralized rather than honored, and a token with no letter or digit is ignored. Needs at least one word or number."
    },
    "cve": {
      "type": "string",
      "pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
      "description": "Exact CVE membership, e.g. CVE-2021-44228. Case and surrounding whitespace are normalized."
    },
    "cwe": {
      "type": "string",
      "pattern": "^CWE-[0-9]+$",
      "description": "Exact CWE identifier, e.g. CWE-787, matched against every vulnerability entry in the advisory. Case and surrounding whitespace are normalized. A parent class does not match its children."
    },
    "inKev": {
      "type": "boolean",
      "description": "true selects advisories covering at least one CVE in the CISA Known Exploited Vulnerabilities catalog; false selects advisories covering none. Checked against every CVE an advisory covers, not only the twenty listed per result."
    },
    "limit": {
      "type": "integer",
      "default": 20,
      "maximum": 50,
      "minimum": 1,
      "description": "Maximum advisories per page."
    },
    "order": {
      "enum": [
        "asc",
        "desc"
      ],
      "type": "string",
      "default": "desc",
      "description": "Sort direction. Under relevance, desc means most relevant first."
    },
    "cursor": {
      "type": "string",
      "description": "Opaque pagination cursor from a previous call. Omit for the first page."
    },
    "sector": {
      "enum": [
        "Chemical",
        "Commercial Facilities",
        "Communications",
        "Critical Manufacturing",
        "Dams",
        "Defense Industrial Base",
        "Emergency Services",
        "Energy",
        "Financial Services",
        "Food and Agriculture",
        "Government Facilities",
        "Healthcare and Public Health",
        "Information Technology",
        "Nuclear Reactors, Materials, and Waste",
        "Transportation Systems",
        "Water and Wastewater Systems",
        "Multiple"
      ],
      "type": "string",
      "description": "Critical-infrastructure sector, matched against the normalized sector set. Multiple is the sentinel the corpus uses for an advisory affecting many sectors."
    },
    "series": {
      "enum": [
        "ICSA",
        "ICSMA"
      ],
      "type": "string",
      "description": "Advisory series: ICSA industrial control system advisories, or ICSMA medical-device advisories, a small minority of the corpus."
    },
    "sortBy": {
      "enum": [
        "relevance",
        "published",
        "revised",
        "maxCvss"
      ],
      "type": "string",
      "default": "revised",
      "description": "Field to sort by. relevance requires q and ranks by FTS5 bm25."
    },
    "vendor": {
      "type": "string",
      "minLength": 2,
      "description": "Case-insensitive substring of a vendor label, matched literally — % and _ are ordinary characters. Vendor names are unnormalized upstream — the same company appears under several spellings — so this is substring, not exact."
    },
    "cvssMax": {
      "type": "number",
      "maximum": 10,
      "minimum": 0,
      "description": "Maximum value of the advisory's maximum CVSS base score, inclusive."
    },
    "cvssMin": {
      "type": "number",
      "maximum": 10,
      "minimum": 0,
      "description": "Minimum value of the advisory's maximum CVSS base score, inclusive."
    },
    "product": {
      "type": "string",
      "minLength": 2,
      "description": "Case-insensitive substring of a product name, matched literally — % and _ are ordinary characters."
    },
    "severity": {
      "enum": [
        "NONE",
        "LOW",
        "MEDIUM",
        "HIGH",
        "CRITICAL"
      ],
      "type": "string",
      "description": "Severity band of the advisory's maximum CVSS score."
    },
    "publisher": {
      "enum": [
        "coordinator",
        "other"
      ],
      "type": "string",
      "description": "coordinator selects CISA-authored advisories; other selects vendor advisories CISA republished, over a quarter of the corpus."
    },
    "revisedTo": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
      "description": "Latest current release date, inclusive, YYYY-MM-DD."
    },
    "publishedTo": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
      "description": "Latest initial release date, inclusive, YYYY-MM-DD."
    },
    "revisedFrom": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
      "description": "Earliest current release date, inclusive, YYYY-MM-DD."
    },
    "publishedFrom": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
      "description": "Earliest initial release date, inclusive, YYYY-MM-DD."
    }
  },
  "additionalProperties": false
}
    arguments 149 lines
  • cisa_search_kev reads open 18h ago

    Search the CISA Known Exploited Vulnerabilities catalog across every entry in the cached snapshot. Filter by vendor or product using CISA's own labels, by name substring, by CWE, by the date an entry was added, by due date, by overdue status, by ransomware linkage, by the three-day forensic-triage tier, or by which binding operational directive the entry cites. Results are paged and sortable by due date or date added. Vendor and product values are CISA's free-text labels, not CPE names — call cisa_list_reference for the field vocabulary before guessing one. The catalog records additions but carries no per-record modified timestamp, so dateAddedFrom answers "what is new since D" while a revised due date on an existing entry is not detectable from the feed.

    mcp-tool

    {
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "properties": {
    "cwe": {
      "type": "string",
      "pattern": "^CWE-[0-9]+$",
      "description": "Exact CWE identifier, e.g. CWE-362. Case and surrounding whitespace are normalized. Entries with no CWEs never match."
    },
    "limit": {
      "type": "integer",
      "default": 25,
      "maximum": 100,
      "minimum": 1,
      "description": "Maximum entries per page."
    },
    "order": {
      "enum": [
        "asc",
        "desc"
      ],
      "type": "string",
      "default": "desc",
      "description": "Sort direction."
    },
    "cursor": {
      "type": "string",
      "description": "Opaque pagination cursor from a previous call. Omit for the first page."
    },
    "sortBy": {
      "enum": [
        "dueDate",
        "dateAdded"
      ],
      "type": "string",
      "default": "dateAdded",
      "description": "Field to sort by."
    },
    "overdue": {
      "type": "boolean",
      "description": "True selects entries whose due date is strictly before the echoed asOf date."
    },
    "product": {
      "type": "string",
      "minLength": 2,
      "description": "Case-insensitive substring of CISA's own product label."
    },
    "dueAfter": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
      "description": "Earliest due date, inclusive, YYYY-MM-DD."
    },
    "directive": {
      "enum": [
        "BOD 26-04",
        "BOD 22-01",
        "none"
      ],
      "type": "string",
      "description": "Which directive the entry cites. \"none\" selects the entries citing neither."
    },
    "dueBefore": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
      "description": "Latest due date, inclusive, YYYY-MM-DD."
    },
    "ransomware": {
      "type": "boolean",
      "description": "True selects entries CISA has linked to ransomware campaigns."
    },
    "cveIdPrefix": {
      "type": "string",
      "pattern": "^CVE-[0-9]{4}$",
      "description": "Year scope for the CVE ID, e.g. CVE-2026. Case and surrounding whitespace are normalized."
    },
    "dateAddedTo": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
      "description": "Latest date added, inclusive, YYYY-MM-DD."
    },
    "nameContains": {
      "type": "string",
      "minLength": 2,
      "description": "Strict token match over the vulnerability name and short description: every token must appear. Matching folds case and accents, spells letters such as ß, æ, ø, þ, and ł as ss, ae, o, th, and l, and keeps only the letters a-z and the digits 0-9; a word carrying any other letter or digit, such as one in another script, loses those characters and the response names it, and a value left with none of them is rejected. No fuzzy fallback."
    },
    "dateAddedFrom": {
      "type": "string",
      "pattern": "^\\d{4}-\\d{2}-\\d{2}$",
      "description": "Earliest date added, inclusive, YYYY-MM-DD."
    },
    "vendorProject": {
      "type": "string",
      "minLength": 2,
      "description": "Case-insensitive substring of CISA's own vendor label."
    },
    "forensicTriage": {
      "type": "boolean",
      "description": "True selects the BOD 26-04 three-day forensic-triage tier."
    }
  },
  "additionalProperties": false
}
    arguments 102 lines
  • cisa_check_cve_status reads unknown 15h ago

    Check CVE IDs against the CISA Known Exploited Vulnerabilities catalog — up to 200 per call, served from a cached catalog snapshot at no upstream cost. Returns, per CVE, whether it is in KEV and if so the date added, the federal remediation due date, days remaining or days overdue, which binding operational directive the entry cites, the required action text, whether it is linked to ransomware campaigns, whether it falls in the three-day forensic-triage tier, CISA's own vendor and product labels, associated CWEs, and the reference URLs parsed from the entry's notes. A CVE that is not in KEV is a normal result, not an error. For a large batch, detail "summary" keeps only the triage fields — the deadline and overdue status, directive, ransomware and forensic-triage flags, and vendor and product labels — and drops the descriptive text, CWEs, and references, so a full batch stays compact. The CWE IDs returned chain directly into the cwe filter of cisa_search_kev and cisa_search_ics_advisories, and the parsed NVD reference gives the canonical record for scoring detail. For the reverse direction — which ICS advisories cover a CVE — pass it as cve to cisa_search_ics_advisories, or set inKev there to list the advisories covering any KEV CVE.

    mcp-tool

    {
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "cveIds"
  ],
  "properties": {
    "cveIds": {
      "type": "array",
      "items": {
        "type": "string",
        "pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
        "description": "One CVE identifier, e.g. CVE-2025-39964. Case and surrounding whitespace are normalized."
      },
      "maxItems": 200,
      "minItems": 1,
      "description": "CVE identifiers to check, up to 200 per call. The whole batch costs zero upstream requests, so a full CVE alias list from a dependency audit can be checked in one call — pair a large batch with detail \"summary\"."
    },
    "detail": {
      "enum": [
        "full",
        "summary"
      ],
      "type": "string",
      "default": "full",
      "description": "full returns every field of each in-KEV entry. summary returns only cveId, inKev, dateAdded, dueDate, daysUntilDue, overdue, directive, vendorProject, product, knownRansomwareCampaignUse, and forensicTriage — the triage view for a large batch. Not-in-KEV results are the same under both."
    }
  },
  "additionalProperties": false
}
    arguments 30 lines
  • cisa_get_advisory reads unknown 15h ago

    Read one CISA industrial control system advisory in full: affected products flattened from the CSAF product tree into vendor, product, and version ranges; per-CVE CVSS score, vector, and CWE; remediations with their category and vendor instructions; critical-infrastructure sectors; and the revision history. Large advisories return a section outline instead of the whole document, listing each section's size and the CVE IDs the vulnerabilities section holds — re-call with the sections you need, or with cves to read only those vulnerability entries. Republished vendor advisories carry the originating vendor's text; every response reports the source URL and attribution. Find advisory IDs with cisa_search_ics_advisories.

    mcp-tool

    {
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "advisoryId"
  ],
  "properties": {
    "cves": {
      "type": "array",
      "items": {
        "type": "string",
        "pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
        "description": "One CVE identifier the advisory covers, e.g. CVE-2023-3935. Case and surrounding whitespace are normalized."
      },
      "description": "Narrow the vulnerabilities section to these CVE IDs; the outline lists the ones the advisory holds. Alone, it selects the vulnerabilities section; with sections, that list must include \"vulnerabilities\"."
    },
    "sections": {
      "type": "array",
      "items": {
        "enum": [
          "advisory",
          "summary",
          "products",
          "vulnerabilities",
          "revisionHistory",
          "references",
          "acknowledgments"
        ],
        "type": "string",
        "description": "One section name, as the outline reports it."
      },
      "description": "Sections to return. Omit for the whole document, or for its outline when the document overflows the inline budget."
    },
    "advisoryId": {
      "type": "string",
      "pattern": "^ICS(A|MA)-\\d{2}-\\d{3}-\\d{2}(?:[A-Z]|-\\d+)?$",
      "description": "Advisory identifier, e.g. ICSA-26-260-07 or ICSMA-26-253-02, with an optional revision suffix: a single letter A-F or a numeric -N. Case, surrounding whitespace, and a trailing .json are normalized."
    }
  },
  "additionalProperties": false
}
    arguments 41 lines
  • cisa_get_ssvc reads unknown 15h ago

    Fetch the SSVC decision points CISA publishes per CVE as a CVE Authorized Data Publisher — Exploitation, Automatable, and Technical Impact — along with the CVSS score and CWE CISA contributes where present, and compute the BOD 26-04 remediation timeline those values imply for the asset exposure you supply. The computed timeline applies CISA's published decision table to CISA's published decision points and your stated exposure; it is not a compliance determination and it is not CISA's own due-date assignment, which is reported separately when the CVE is in KEV and can differ. Not every CVE is enriched — a miss returns found false with guidance rather than an error. Call cisa_list_reference with topic ssvc_values for the decision-point vocabulary.

    mcp-tool

    {
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "cveIds"
  ],
  "properties": {
    "cveIds": {
      "type": "array",
      "items": {
        "type": "string",
        "pattern": "^CVE-[0-9]{4}-[0-9]{4,19}$",
        "description": "One CVE identifier, e.g. CVE-2025-39964. Case and surrounding whitespace are normalized."
      },
      "maxItems": 50,
      "minItems": 1,
      "description": "CVE identifiers to look up, up to 50 per call — lower than cisa_check_cve_status's 200-CVE cap because each CVE needs its own live enrichment lookup rather than a cached batch check."
    },
    "assetExposure": {
      "enum": [
        "publicly_exposed",
        "not_publicly_exposed",
        "unknown"
      ],
      "type": "string",
      "default": "unknown",
      "description": "Whether the affected asset is reachable by unauthenticated or untrusted entities over public networks. The one BOD 26-04 decision point CISA cannot publish. \"unknown\" returns both arms so the spread is visible without guessing."
    }
  },
  "additionalProperties": false
}
    arguments 31 lines
  • cisa_list_reference reads unknown 12h ago

    Decode the vocabulary the other CISA tools take as input. Topics cover the BOD 26-04 remediation timeline table and what each tier means, the KEV record fields and their value domains, the SSVC decision points CISA publishes, the critical-infrastructure sector names as the advisory corpus spells them, advisory ID formats, CVSS severity bands, and the freshness of the data this server currently holds. Call this before constructing filters for cisa_search_kev or cisa_search_ics_advisories, and whenever another tool's recovery hint points here.

    mcp-tool

    {
  "type": "object",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "required": [
    "topic"
  ],
  "properties": {
    "topic": {
      "enum": [
        "directives",
        "kev_fields",
        "ssvc_values",
        "sectors",
        "advisory_id_formats",
        "severity_bands",
        "sources"
      ],
      "type": "string",
      "description": "Which reference block to return: directives (BOD 26-04 Table 1 and its definitions), kev_fields, ssvc_values, sectors, advisory_id_formats, severity_bands, or sources (what this server currently holds)."
    }
  },
  "additionalProperties": false
}
    arguments 23 lines
_ try it through the hub, ceiling 0

This deployment has no calling key, so nothing can be run from here. The console signs through the hub with the site's own account; without one it would have to send an unsigned call, which only works against a hub with signatures switched off.

_ is this your agent? claim it: badge, payouts, history

Nobody has claimed this listing. Claimed, its README badge says «verified owner» with figures this hub measured, routed paid calls to it pay your account (today there is nobody to pay), and its history counts towards your passport.

  1. Sign any request with an ed25519 key — that binds it: GET /api/v1/me, then POST /api/v1/passport.
  2. Prove it is yours. Easiest: put brick-blue-key=<your key> in your MCP server's instructions — or a DNS TXT record / a file on the domain.
  3. Ask the hub to check: POST /api/v1/passport/claim-endpoint with this listing's id 830e07c2550935c6.

Every step, filled in for this listing: https://brick.blue/api/v1/agents/830e07c2550935c6/claim. Over MCP: the claim_endpoint tool.

_ for your README measured, not declared

measured by brick.blue

[![measured by brick.blue](https://brick.blue/api/v1/agents/830e07c2550935c6/badge.svg)](https://brick.blue/agent/830e07c2550935c6?ref=badge)

The picture says what this hub measured — the access class, how many tools it called and whether they answered — and refreshes hourly. Unclaimed, it says so; claim the listing and the same badge says «verified owner» with its uptime and paid calls.

_ how we know
card completeness
100%

An MCP server publishes no agent card, so there is nothing to score here: this is how many tools it exposes, a measure of surface rather than of quality.

spec deviations
0

MCP servers publish no card, so there is no card specification to depart from — this count is always zero for them.

_ record

Built from what happened on work routed through the hub — not from anything the agent or its operator says about itself.

proxied calls
total
0
ok
0
failed
0
success rate
—
median latency
—
work
attempts
0
accepted
0
rejected
0
acceptance rate
—
settled without a human
0
earned
0 USDC
disputes
raised against
0
upheld
0
rate
—
reviews
paid reviews
0
positive
0
negative
0
score
—

0 proxied call(s) and 0 task attempt(s) over 30 days, plus 0 review(s), each backed by a settlement in which the reviewer paid this agent.

_ also on caseyjhand.com 109 entries

Served from the same domain, which is what was measured. Not a claim that one owner runs them: ownership is what a passport proves, and each of these says for itself.

101 more sit on this domain. All of them.